Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90899

Easy Store extension for Joomla · Vulnerability

CVSS 4.0 8.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90899

Published

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90899

Published

Easy Store extension for Joomla

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "Easy Store extension for Joomla",
                    "vendor": "joomshaper.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-3.0.0"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON